The judgment of the Frankfurt Regional Court of 16 September 2026, the full text of which is available in our Judykatura database, materially develops the limits of social-media platforms’ liability for fake profiles and advertisements. The court held that algorithmic management of the display of advertisements and posts may deprive an operator of the hosting exemption under Article 6 DSA.

This article is available free of charge in full. Subscribe to our newsletter to receive new case notes and a discount code for your first subscription.

The significance of the ruling goes beyond responding to a single notice. The court held that control over content may result not only from individual moderation, but also from the way in which a platform pre-designs the rules for distributing, ranking and displaying content to particular users.

What was the case about?

The case concerned fake profiles and advertisements published on two social-media platforms. They used a company name, the image and the name of one of its co-founders. The content suggested an association with the rights holders, and users were subsequently directed to groups in which investments were promoted.

The claimants repeatedly reported infringements and provided the platform with reference materials. According to the court’s findings, the removal of example fake profiles took between 14 and 20 days; one video material remained online for 62 days. The court ordered the operator to cease disseminating specified content, ordered it to provide information and declared it liable in damages.

Can an algorithm constitute control over content?

The court started from the concept of service-provider neutrality developed by the CJEU in Webgroup and Coyote. It held that the liability exemption does not apply where an operator exercises control over stored information, even if automated processing does not give it individual knowledge of the content.

The court referred to the standard arising from the CJEU case law: “an operator of an information society service which controls the information stored is excluded from the exemption in Article 14(1) of the E-Commerce Directive, even if it does not acquire knowledge of that information because of the automated nature of its processing” (editorial translation).

Control may be exercised through an algorithm. What matters is whether the operator has determined in advance the conditions under which information is disseminated or not disseminated. A later, separate intervention in relation to each post is therefore not necessary.

The court further emphasised that an algorithm exceeds the function of merely organising information where, “in the interest of the operator or its service, it determines the conditions, manner and order in which information is disseminated” (editorial translation). That element distinguishes technical infrastructure from a system actively managing the distribution of content.

Advertising auctions and feed ranking

As regards advertising, the court noted the automated auction system. The platform set, according to its own criteria, the order and timing of advertisement display, while also taking account of a quality score. Although the advertiser selected a target group and made a bid, it could not be certain whether the advertisement would ultimately be displayed and to which specific users.

The platform determined the rules for allocating advertising space. In the court’s view, this amounted to a superior control function over the manner in which advertisements were disseminated.

The court assessed unpaid user content in the same way. Its appearance in other users’ feeds was managed by a ranking algorithm established by the operator. The author of a post decided to upload it, but the operator decided – under its own rules – in which feeds and at what time the post would appear.

The court found that this activity also served the platform’s economic interest. In the case of advertisements, it was directly linked to revenue; in the case of content ranking, it was intended to increase interaction, reach and the advertising value of the service.

Must a platform act expeditiously after a notice?

The court held that even if the operator could rely on Article 6 DSA, it had to act expeditiously upon acquiring knowledge of unlawful content by disabling access or removing it. In this case, removal periods of 14 and 20 days for clearly unlawful fake profiles were not considered expeditious.

The assessment of earlier reports was also important. The claimants had provided reference photographs, reported more than 200 infringements and described the characteristics of fake profiles. The court held that the description was sufficiently specific to permit the technical detection of further potential infringements.

This did not establish a general monitoring obligation. The court confined the duty to the particular case and to future fake profiles identical or substantially equivalent to those already reported.

Knowledge does not depend solely on a formal notice

An important part of the reasoning concerns the relationship between Articles 6 and 16 DSA. The court held that a notice meeting the conditions of Article 16 DSA gives rise to deemed knowledge of the relevant information. It does not follow, however, that only such a notice can give the operator actual knowledge.

Where a platform has in fact found and removed the reported material, it cannot simply challenge the formal adequacy of the notice. It must show when it acquired knowledge and which actions it took, and when, in order to satisfy the requirement of expeditious action.

What did the court decide about personal data?

The case also included arguments based on the GDPR. Photographs and videos depicting a natural person contained that person’s personal data, and the claimants challenged the legal basis for their processing. The court did not, however, rule on GDPR liability on the merits, because it upheld claims based on personality rights, image rights and the right to a name.

The court nevertheless stated that Article 17(1) GDPR is not an independent legal basis for an injunction. An infringement of Article 6 GDPR may, however, support injunction claims arising under national law. This part of the judgment is important above all for properly separating substantive legal bases: the court upheld national-law protection, but did not determine that the platform operator had infringed the GDPR.

Key conclusions

First, automation does not preclude control over content. On the contrary, an algorithm that determines the conditions, manner and order of distribution may be an instrument of such control.

Second, advertising auctions and feed ranking may demonstrate an active role of the platform where they are based on rules established by the operator and serve its economic interest.

Third, an operator with actual knowledge of unlawful fake profiles must demonstrate prompt and specific action. Removing obvious infringements after several weeks does not meet that standard.

Fourth, the judgment does not determine a GDPR infringement. It does confirm, however, that using a person’s image and name in fake profiles may give rise to effective claims under national law, while data-protection arguments require separate assessment.

This material was prepared partly with the use of a general-purpose AI model and, despite due care, may contain errors. The information provided does not constitute legal advice — it reflects solely the Author's view.